RE: cert chain out of order breaks openssl

2012-02-14 Thread Erik Tkal
-openssl-us...@openssl.org [mailto:owner-openssl-us...@openssl.org] On Behalf Of Timothy Kay Sent: Tuesday, February 14, 2012 12:46 PM To: openssl-users@openssl.org Subject: cert chain out of order breaks openssl We have been baffled for a long time that curl cannot access websites that work just fine

Re: cert chain out of order breaks openssl

2012-02-14 Thread Timothy Kay
...@openssl.org [mailto: owner-openssl-us...@openssl.org] *On Behalf Of *Timothy Kay *Sent:* Tuesday, February 14, 2012 12:46 PM *To:* openssl-users@openssl.org *Subject:* cert chain out of order breaks openssl ** ** ** ** We have been baffled for a long time that curl cannot access

Re: cert chain out of order breaks openssl

2012-02-14 Thread Jeffrey Walton
On Tue, Feb 14, 2012 at 3:22 PM, Timothy Kay tim...@not.com wrote: Thanks for the pointer. It's very helpful. HOWEVER, I can give you dozens of different sites that do it wrong, yet they all work in the browsers. Clearly that particular part of the spec is no longer relevant, and openssl

Re: cert chain out of order breaks openssl

2012-02-14 Thread Dr. Stephen Henson
On Tue, Feb 14, 2012, Timothy Kay wrote: Erik, Thanks for the pointer. It's very helpful. HOWEVER, I can give you dozens of different sites that do it wrong, yet they all work in the browsers. Clearly that particular part of the spec is no longer relevant, and openssl should be updated.

Re: cert chain out of order breaks openssl

2012-02-14 Thread Dr. Stephen Henson
On Tue, Feb 14, 2012, Timothy Kay wrote: We have been baffled for a long time that curl cannot access websites that work just fine in the browser (unless we use --insecure, of course). The curl documentation points you to http://curl.haxx.se/docs/sslcerts.html, which explains that your server